Dashboard:
- typescript: 6.0.3 -> 7.0.2 (tsc via @typescript/native alias; typescript-eslint
  keeps the TS 6.0.2 API via @typescript/typescript6, per the TS 7 side-by-side guidance)
- @playwright/test: 1.61.1 -> 1.62.0
- @radix-ui/react-dropdown-menu: 2.1.23 -> 2.1.24
- @radix-ui/react-slot: 1.3.2 -> 1.3.3
- @radix-ui/react-tooltip: 1.2.15 -> 1.2.16
- brace-expansion pinned >=5.0.8 via pnpm override (GHSA-mh99-v99m-4gvg, high)

Website:
- @playwright/test: 1.61.1 -> 1.62.0
- playwright: 1.61.1 -> 1.62.0

Go modules:
- github.com/charmbracelet/x/exp/golden: 20260622092256 -> 20260720091843
- github.com/google/pprof: 20260604005048 -> 20260709232956

GitHub Actions:
- actions/checkout: v7.0.0 -> v7.0.1
- actions/setup-go: v6.5.0 -> v7.0.0
- actions/setup-node: v6.4.0 -> v7.0.0
- actions/setup-python: v6.3.0 -> v7.0.0
- github/codeql-action: v4 SHA refresh

CI tool pins:
- mage: v1.15.0 -> v1.17.2 (matches go.mod)
- golangci-lint: v2.1.6 -> v2.12.2
- staticcheck: v0.6.1 -> v0.7.0
- govulncheck: v1.1.4 -> v1.6.0

Also refreshes cli/demo/api and cli/tests/visual manifests. gosec stays at
v2.22.4; v2.28.0 stops honoring the existing #nosec annotations under the
-nosec flag this repo passes, so that needs its own triage pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2127a7a3-47c9-410a-9f75-7eaf08125751